UAT-4356

UAT-4356 is a state-linked cyberespionage threat actor focused on compromising network perimeter infrastructure, especially Cisco security appliances. The group is closely associated with the ArcaneDoor campaign and is also tracked by Microsoft as Storm-1849. Reporting has linked the actor to a China-nexus ecosystem, although some vendors have described it more cautiously as government-backed without public formal state attribution. UAT-4356 has repeatedly targeted Cisco ASA, Firepower, and Secure Firewall devices, including Firepower eXtensible Operating System environments, by exploiting vulnerabilities in internet-facing VPN and management surfaces. In ArcaneDoor, the actor compromised Cisco ASA devices via zero-day vulnerabilities. In later activity, the group continued operations by exploiting known Cisco ASA and FTD vulnerabilities, including CVE-2025-20333 and CVE-2025-20362, to obtain unauthorized access and deploy custom implants. The actor’s tooling includes LINE VIPER and the FIRESTARTER backdoor. LINE VIPER has been used for post-exploitation functions including VPN authentication bypass, packet capture, credential and key material access, command execution, and suppression of logging. FIRESTARTER is a device-native Linux backdoor designed for Cisco firewall platforms that hooks the LINA process, replaces legitimate WebVPN request-handling logic, and executes attacker-supplied shellcode directly in memory in response to specially crafted authentication-related requests. The malware is notable for stealthy operation inside trusted device processes, minimal on-disk footprint, and persistence mechanisms tied to Cisco Service Platform mount-list manipulation and reboot behavior. It has been observed surviving normal reboots, firmware updates, and patching, enabling the actor to regain access after remediation unless devices are fully reimaged or otherwise thoroughly remediated. Operationally, UAT-4356 emphasizes covert access to edge devices rather than traditional endpoint malware deployment. This provides visibility into VPN, authentication, and network traffic while bypassing many endpoint-focused defenses. Observed behavior includes exploitation for initial access, in-memory payload execution, persistence, post-exploitation on trusted network appliances, and long dwell time in victim environments. Confirmed victimology includes at least a U.S. federal civilian agency, and authorities have assessed the activity may be part of a broader campaign affecting government and critical national infrastructure networks.